This policy explains what Anni Planner collects, why, where it lives, how long we keep it, and the choices teachers, schools, and parents have. Anni is a digital classroom planner for teachers. We are a small operation and this policy is written to be read, not skimmed past. The short version: your planner data is yours, we use it only to run the planner, we never sell it, and we never use student information for advertising of any kind.
1. What we collect
From teachers (our account holders)
- Account details: name, display name, email address, school, district, grade level, phone number, and a password we store only as a salted, keyed cryptographic hash (never readable).
- Planner content you create: lesson plans, schedules, calendars, to-do lists, notes, substitute instructions, and files you upload (photos, videos, PDFs).
- If you turn on two-step verification by text, the cell number you give us for login codes.
- If you connect your Google account, Anni holds the access token Google issues so it can read and write your Gmail, Calendar, or Docs at your request. You can disconnect at any time, which revokes our access.
About students (entered by the teacher, never collected from children)
- Class rosters and related lists a teacher uploads or types: student names and, if the teacher includes them, parent contact details, transportation notes, and medical flags.
- Classroom records a teacher keeps: checklists, behavior and sign-out logs, grades-adjacent marks, and notes.
- Student game portal records: the first-name account a teacher creates, game scores, and session progress. The games never ask a child for their name, email, address, phone number, photo, or any other contact information, and have no free-text fields that invite personal information.
Collected automatically
- Security log entries: logins and failed logins, verification codes sent, password changes, share links created and opened, roster changes, and account deletions. These entries store the network address only as an irreversible hash.
- Standard web server records kept by our hosting provider (Cloudflare) to run and protect the service.
We do not collect precise location, biometric information, or audio or video of students. We use no advertising or analytics trackers, no third-party cookies, and no third-party scripts anywhere on the site.
2. What we use it for, and what we never do
We use the information above for exactly one business purpose: providing, securing, supporting, and improving the planner a teacher signed up for. Consistent with Arizona's student data privacy law (A.R.S. § 15-1046) and our own rules, we never:
- sell or rent personal information, student or teacher, to anyone;
- show advertising on the service or use covered student information or persistent identifiers for targeted advertising anywhere;
- build a profile of a student for any purpose other than the classroom purposes the teacher is using Anni for;
- use student information to train artificial intelligence models;
- disclose student information to third parties except the service providers below (bound by contract to use it only to serve us, disclose it to no one, and protect it), or when a law, court order, or genuine safety emergency requires it.
We may use information that cannot be linked to an identified student (aggregate or de-identified data, such as overall feature usage) to improve and demonstrate the service, as A.R.S. § 15-1046(E) permits.
3. Who touches the data (subprocessors)
| Provider | What it does | What it can see |
|---|---|---|
| Cloudflare, Inc. (US) | Hosts the application, database, and file storage; encrypts stored data at rest | All service data |
| Backblaze, Inc. (US) | Holds nightly backup archives, encrypted by us before they leave Cloudflare | Encrypted archives it cannot read; file copies |
| Twilio Inc. (US) | Delivers login code text messages | The teacher's cell number and the code message |
| Resend (US) | Delivers service email (login codes, notices, lesson packets a teacher sends) | Email addresses and the message content |
| Google LLC (US) | Only if the teacher connects Google: Gmail, Calendar, Docs access the teacher initiates | What the teacher's Google account shares |
Each provider handles this data under its published data protection terms, which restrict use of the data to providing its service to us, prohibit further disclosure, and require reasonable security; we keep those terms on file to meet A.R.S. § 15-1046(A)(4)(f). We will update this table and give prominent notice before adding a provider that would handle student information.
4. Where it lives and how it is protected
All service data is stored in the United States, encrypted in transit (HTTPS everywhere, enforced) and at rest. Passwords are hashed with a per-user salt and a separate server-held secret key. Optional two-step login verification, remembered-device controls, login rate limiting, an append-only security audit log, and nightly encrypted off-platform backups protect the account layer; the Security page describes the full program, including who is responsible for it and how we review it.
5. How long we keep things (retention schedule)
We keep personal information only as long as there is a classroom reason to have it, never indefinitely:
| Data | Kept | Why (business need) | Then |
|---|---|---|---|
| Teacher account and planner content, including student records inside it | While the account is active, and no more than 24 months past the teacher's last sign-in (we email twice before acting) | It is the teacher's working planner | Erased from live systems on account deletion or school deletion request; backup copies age out within 90 days |
| Student game accounts and scores | While the teacher keeps them | Classroom use by the teacher | Erased when the teacher removes them or deletes the account |
| Share links (substitute, absent work, parent views, timelines) | Until their built-in expiry: parent day-views expire the next day, substitute links after 7 days, absent work links 14 days after the last covered day, timeline links after 30 days | Time-limited sharing is the feature | Stop working automatically; rows swept |
| Security audit log | 1 year | Security accountability and breach investigation | Deleted after 1 year |
| Backups | 90 days per archive | Disaster recovery | Aged out; deleted data leaves the newest backup within a day and all backups within the window |
| Login throttle and expired session records | Hours to days | Abuse prevention | Swept automatically |
6. Deletion and your controls
- Teachers can delete any content at any time, and can permanently delete their entire account and every record in it from Settings (password plus typed confirmation). The purge removes every record and stored file from live systems immediately; backup copies age out within 90 days.
- Schools: when a public school asks us to delete a student's covered information, we delete it from live systems within ten (10) business days and confirm in writing, meeting A.R.S. § 15-1046(C)(2), unless the student's parent or guardian consents to keeping it. Email us and we will act on it promptly.
- Parents and guardians: Anni's student records are classroom records your child's teacher keeps. To review or correct them, start with the teacher or school, which controls them; we support the school's requests. If you believe the service itself holds information about your child that should be deleted, contact us directly and we will work with the school to resolve it.
7. Children's privacy (COPPA)
Anni's student game portals are used by children under 13. Consistent with the Federal Trade Commission's guidance on education technology, we rely on school authorization in place of individual parental consent; teachers confirm at signup that they use Anni at their school's direction and under its policies, and districts can put this on contract footing with our Data Privacy Agreement. That reliance is available only because of how Anni works: the teacher creates the account (a first name only), the games collect no contact information from children, children's information is used for no commercial purpose beyond providing the classroom service, is never used for advertising or sold, and the school or teacher controls it, including deletion, at all times. The retention schedule in section 5 is our written children's data retention policy: student information is kept only while the teacher keeps it, and never indefinitely.
8. If something goes wrong (security breaches)
If we determine that a security breach has exposed personal information as Arizona law defines it (a name combined with sensitive identifiers, or credentials that open an online account), where that information was not encrypted or redacted or its protection was also compromised, we will notify affected account holders without unreasonable delay and within 45 days as Arizona law (A.R.S. § 18-552) requires, tell the affected school what student information was involved, and, if more than 1,000 Arizona residents are affected, notify the Arizona Attorney General and the national consumer reporting agencies. Our breach response steps are part of the written security program described on the Security page.
9. Changes to this policy
We will post prominent notice on the service before any material change to this policy takes effect, as A.R.S. § 15-1046(C)(3) requires, and the effective date above always reflects the current version. A change will never retroactively loosen what this policy promises about student information without the school's consent.
10. If the business changes hands, or the operator cannot continue
Anni is run by one person. If the service is ever sold or transferred, student and teacher information transfers only to a successor bound by these same promises, with prominent notice to account holders before the transfer, as A.R.S. § 15-1046 contemplates. A documented continuity procedure (credentials, backups, and wind-down steps held with the operator's family) ensures that if the operator becomes unavailable, teachers and schools get notice, a full export window of at least 60 days, and deletion at the end of it rather than an abandoned database.
11. Contact
Jon Hegreness, operator of Anni Planner: privacy@anniplanner.com. We answer privacy questions from teachers, school staff, and parents.